AI for e-commerce and GDPR: what to check before switching it on

The right question is not «is it GDPR compliant?»

No software is GDPR compliant on its own: compliance concerns a processing activity — that data, for that purpose, with those safeguards. A vendor who answers «yes, we are GDPR compliant» and stops there has not answered.

The questions that get a verifiable answer are four others: who is controller and who is processor, what data is processed, where it sits, and what happens when someone asks for deletion.

Who is controller and who is processor

This is the part most often skipped, and the one that determines the obligations.

When you switch on an AI assistant in your store, you remain the controller of your customers' data. You decide the purposes and means: you decided to place a tool that talks to your customers. The AI vendor processes that data on your behalf and on your instructions: it is a processor.

Concrete consequences follow. A written agreement between the two is required — the DPA under Article 28 of the Regulation — and it must exist before processing begins. The privacy notice your customers read is yours, and must name the assistant. Access or deletion requests reach you, and you must be able to pass them on.

Account and billing data is a different matter: there the vendor is a controller in its own right. With Flow-e the two roles are separated and written down: the documents are in the legal section, and a dedicated chat notice describes the processing of end customers' data.

What data an AI assistant actually processes

More than the word «chat» suggests. An assistant connected to the store sees the text of conversations — where people write things they would never put in a form — and, if it answers about orders, also name, shipping address and purchase history.

Two questions follow, for any vendor: how long conversations are retained, and whether the vendor reads them. «Forever, and yes» is a legitimate answer only if declared and justified.

Where the data sits, and why it matters

Transferring personal data outside the European Union is not forbidden, but it is regulated: it requires a legal basis and documented safeguards. The practical point is that you need to know this, because it goes in your privacy notice.

The right question is literal: in which countries are the servers running the conversations, and those of the models processing them? Two different things, sometimes with two different answers — an application hosted in Europe can call a model hosted elsewhere.

Flow-e keeps data on servers in the European Union and is an Italian company: jurisdiction, supervisory authority and the language of the documents are those of your own legal system, which matters most on the day you need to contest something.

Are conversations used to train models?

The most important question, and the easiest to ask. If your customers' conversations feed the training of a general-purpose model, that data leaves the perimeter you declared and does not come back.

The answer belongs in the contract, not on a marketing page. In Flow-e, conversations are not used to train third-party AI, and this is stated in the published documents.

What the AI Act requires

The European AI Regulation (EU 2024/1689) classifies systems by risk. A conversational assistant on an e-commerce is not among the high-risk systems, but it falls under the transparency obligations: people must be informed that they are interacting with an artificial intelligence system, unless it is obvious from the context. These provisions apply from 2 August 2026.

In practice this means declaring it where the conversation starts, not at the bottom of a legal page. Flow-e declares its AI nature within the conversation itself.

What remains yours to do

A short list that stays with you, whichever vendor you choose:

• Sign the DPA before the widget goes live.
• Update your privacy notice, naming the assistant and the purposes.
• Update your record of processing activities, if you keep one.
• Know how a customer's data is deleted before someone asks.
• Check the cookie banner: if the widget writes cookies or uses local storage, treat it like your other tools.

It is not a heavy task, but it is a task: doing it later, when a data subject request arrives, costs considerably more.

Where Flow-e stands

Servers in the European Union. A published DPA you can read before signing. Conversations not used to train third-party AI. Data export and deletion on request. AI nature declared in the conversation. An Italian company, with registered address and VAT number published in the legal documents.

Each of these is verifiable, one by one, in the legal section: which is how any vendor should be assessed, this one included.